package com.lpb.spring.lpbspring.getway.model;

import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * cher on 2017/11/15.
 */
public class XssDefense {
    protected static final boolean ALWAYS_MAKE_TAGS = true;
    protected static final boolean STRIP_COMMENTS = true;
    protected static final int REGEX_FLAGS_SI = Pattern.CASE_INSENSITIVE | Pattern.DOTALL;
    protected Map<String, List<String>> vAllowed;
    protected Map<String, Integer> vTagCounts;
    protected String[] vSelfClosingTags;
    protected String[] vNeedClosingTags;
    protected String[] vProtocolAtts;
    protected String[] vAllowedProtocols;
    protected String[] vRemoveBlanks;
    protected String[] vAllowedEntities;
    protected static XssDefense defense = new XssDefense();

    public XssDefense() {
        vAllowed = new HashMap<>();
        vTagCounts = new HashMap<>();
        ArrayList<String> a_atts = new ArrayList<>();
        a_atts.add("href");
        a_atts.add("target");
        vAllowed.put("a", a_atts);

        ArrayList<String> img_atts = new ArrayList<>();
        img_atts.add("src");
        img_atts.add("width");
        img_atts.add("height");
        img_atts.add("alt");
        vAllowed.put("img", img_atts);

        ArrayList<String> no_atts = new ArrayList<>();
        vAllowed.put("b", no_atts);
        vAllowed.put("strong", no_atts);
        vAllowed.put("i", no_atts);
        vAllowed.put("em", no_atts);

        vSelfClosingTags = new String[]{"img"};
        vNeedClosingTags = new String[]{"a", "b", "strong", "i", "em"};
        vAllowedProtocols = new String[]{"http", "mailto"};
        vProtocolAtts = new String[]{"src", "href"};
        vRemoveBlanks = new String[]{"a", "b", "strong", "i", "em"};
        vAllowedEntities = new String[]{"amp", "gt", "lt", "quot"};
    }

    private void reset() {
        vTagCounts = new HashMap<>();
    }

    public static String chr(int decimal) {
        return String.valueOf((char) decimal);
    }

    public static String htmlEncode(String s) {
        s = s.replaceAll("&", "&amp;");
        s = s.replaceAll("\"", "&quot;");
        s = s.replaceAll("\'", "&apos;");
        s = s.replaceAll("<", "&lt;");
        s = s.replaceAll(">", "&gt;");
        return s;
    }

    public static String htmlDecode(String s) {
        s = s.replaceAll("&amp;", "&");
        s = s.replaceAll("&quot;", "\"");
        s = s.replaceAll("&apos;", "\'");
        s = s.replaceAll("&lt;", "<" );
        s = s.replaceAll("&gt;", ">");
        return s;
    }

    public static String defense(String input) {
        return defense.filter(input);
    }

    public synchronized String filter(String input) {
        reset();
        String s = input;
        s = escapeComments(s);
        s = balanceHTML(s);
        s = checkTags(s);
        s = processRemoveBlanks(s);
        s = validateEntities(s);
        return s;
    }
    private String escapeComments(String s) {
        Pattern p = Pattern.compile("<!--(.*?)-->", Pattern.DOTALL);
        Matcher m = p.matcher(s);
        StringBuffer buf = new StringBuffer();
        if (m.find()) {
            String match = m.group(1); //(.*?)
            m.appendReplacement(buf, "<!--" + htmlEncode(match) + "-->");
        }
        m.appendTail(buf);

        return buf.toString();
    }
    private String balanceHTML(String s) {
        if (ALWAYS_MAKE_TAGS) {
            s = regexReplace("^>", "", s);
            s = regexReplace("<([^>]*?)(?=<|$)", "<$1>", s);
            s = regexReplace("(^|>)([^<]*?)(?=>)", "$1<$2", s);
        } else {
            s = regexReplace("<([^>]*?)(?=<|$)", "&lt;$1", s);
            s = regexReplace("(^|>)([^<]*?)(?=>)", "$1$2&gt;<", s);
            s = s.replaceAll("<>", "");
        }
        return s;
    }

    private String checkTags(String s) {
        Pattern p = Pattern.compile("<(.*?)>", Pattern.DOTALL);
        Matcher m = p.matcher(s);

        StringBuffer buf = new StringBuffer();
        while (m.find()) {
            String replaceStr = m.group(1);
            replaceStr = processTag(replaceStr);
            m.appendReplacement(buf, replaceStr);
        }
        m.appendTail(buf);
        s = buf.toString();
        for (String key : vTagCounts.keySet()) {
            for (int ii = 0; ii < vTagCounts.get(key); ii++) {
                s += "</" + key + ">";
            }
        }

        return s;
    }

    private String processRemoveBlanks(String s) {
        for (String tag : vRemoveBlanks) {
            s = regexReplace("<" + tag + "(\\s[^>]*)?></" + tag + ">", "", s);
            s = regexReplace("<" + tag + "(\\s[^>]*)?/>", "", s);
        }
        return s;
    }

    private String regexReplace(String regex_pattern, String replacement, String s) {
        Pattern p = Pattern.compile(regex_pattern);
        Matcher m = p.matcher(s);
        return m.replaceAll(replacement);
    }

    private String processTag(String s) {
        Pattern p = Pattern.compile("^/([a-z0-9]+)", REGEX_FLAGS_SI);
        Matcher m = p.matcher(s);
        if (m.find()) {
            String name = m.group(1).toLowerCase();
            if (vAllowed.containsKey(name)) {
                if (!inArray(name, vSelfClosingTags)) {
                    if (vTagCounts.containsKey(name)) {
                        vTagCounts.put(name, vTagCounts.get(name) - 1);
                        return "</" + name + ">";
                    }
                }
            }
        }

        p = Pattern.compile("^([a-z0-9]+)(.*?)(/?)$", REGEX_FLAGS_SI);
        m = p.matcher(s);
        if (m.find()) {
            String name = m.group(1).toLowerCase();
            String body = m.group(2);
            String ending = m.group(3);
            if (vAllowed.containsKey(name)) {
                String params = "";

                Pattern p2 = Pattern.compile("([a-z0-9]+)=([\"'])(.*?)\\2", REGEX_FLAGS_SI);
                Pattern p3 = Pattern.compile("([a-z0-9]+)(=)([^\"\\s']+)", REGEX_FLAGS_SI);
                Matcher m2 = p2.matcher(body);
                Matcher m3 = p3.matcher(body);
                List<String> paramNames = new ArrayList<>();
                List<String> paramValues = new ArrayList<>();
                while (m2.find()) {
                    paramNames.add(m2.group(1)); //([a-z0-9]+)
                    paramValues.add(m2.group(3)); //(.*?)
                }
                while (m3.find()) {
                    paramNames.add(m3.group(1)); //([a-z0-9]+)
                    paramValues.add(m3.group(3)); //([^\"\\s']+)
                }

                String paramName, paramValue;
                for (int ii = 0; ii < paramNames.size(); ii++) {
                    paramName = paramNames.get(ii).toLowerCase();
                    paramValue = paramValues.get(ii);
                    if (vAllowed.get(name).contains(paramName)) {
                        if (inArray(paramName, vProtocolAtts)) {
                            paramValue = processParamProtocol(paramValue);
                        }
                        params += " " + paramName + "=\"" + paramValue + "\"";
                    }
                }

                if (inArray(name, vSelfClosingTags)) {
                    ending = " /";
                }
                if (inArray(name, vNeedClosingTags)) {
                    ending = "";
                }
                if (ending == null || ending.length() < 1) {
                    if (vTagCounts.containsKey(name)) {
                        vTagCounts.put(name, vTagCounts.get(name) + 1);
                    } else {
                        vTagCounts.put(name, 1);
                    }
                } else {
                    ending = " /";
                }
                return "<" + name + params + ending + ">";
            } else {
                return "";
            }
        }

        p = Pattern.compile("^!--(.*)--$", REGEX_FLAGS_SI);
        m = p.matcher(s);
        if (m.find()) {
            String comment = m.group();
            if (STRIP_COMMENTS) {
                return "";
            } else {
                return "<" + comment + ">";
            }
        }
        return "";
    }
    private String processParamProtocol(String s) {
        s = decodeEntities(s);
        Pattern p = Pattern.compile("^([^:]+):", REGEX_FLAGS_SI);
        Matcher m = p.matcher(s);
        if (m.find()) {
            String protocol = m.group(1);
            if (!inArray(protocol, vAllowedProtocols)) {
                s = "#" + s.substring(protocol.length() + 1);
                if (s.startsWith("#//")) {
                    s = "#" + s.substring(3);
                }
            }
        }

        return s;
    }
    private String decodeEntities(String s) {
        StringBuffer buf = new StringBuffer();

        Pattern p = Pattern.compile("&#(\\d+);?");
        Matcher m = p.matcher(s);
        while (m.find()) {
            String match = m.group(1);
            int decimal = Integer.decode(match);
            m.appendReplacement(buf, chr(decimal));
        }
        m.appendTail(buf);
        s = buf.toString();

        buf = new StringBuffer();
        p = Pattern.compile("&#x([0-9a-f]+);?");
        m = p.matcher(s);
        while (m.find()) {
            String match = m.group(1);
            int decimal = Integer.decode(match);
            m.appendReplacement(buf, chr(decimal));
        }
        m.appendTail(buf);
        s = buf.toString();

        buf = new StringBuffer();
        p = Pattern.compile("%([0-9a-f]{2});?");
        m = p.matcher(s);
        while (m.find()) {
            String match = m.group(1);
            int decimal = Integer.decode(match);
            m.appendReplacement(buf, chr(decimal));
        }
        m.appendTail(buf);
        s = buf.toString();

        s = validateEntities(s);
        return s;
    }
    private String validateEntities(String s) {
        Pattern p = Pattern.compile("&([^&;]*)(?=(;|&|$))");
        Matcher m = p.matcher(s);
        if (m.find()) {
            String one = m.group(1); //([^&;]*)
            String two = m.group(2); //(?=(;|&|$))
            s = checkEntity(one, two);
        }
        p = Pattern.compile("(>|^)([^<]+?)(<|$)", Pattern.DOTALL);
        m = p.matcher(s);
        StringBuffer buf = new StringBuffer();
        if (m.find()) {
            String one = m.group(1); //(>|^)
            String two = m.group(2); //([^<]+?)
            String three = m.group(3); //(<|$)
            m.appendReplacement(buf, one + two.replaceAll("\"", "&quot;") + three);
        }
        m.appendTail(buf);

        return s;
    }

    private String checkEntity(String preamble, String term) {
        if (!term.equals(";")) {
            return "&amp;" + preamble;
        }

        if (isValidEntity(preamble)) {
            return "&" + preamble;
        }

        return "&amp;" + preamble;
    }
    private boolean isValidEntity(String entity) {
        return inArray(entity, vAllowedEntities);
    }
    private boolean inArray(String s, String[] array) {
        for (String item : array) {
            if (item != null && item.equals(s)) {
                return true;
            }
        }
        return false;
    }
}
